From: Julien Cristau Date: Mon, 14 Oct 2019 17:52:12 +0000 (+0200) Subject: Use a pre-up script to turn off accept_ra X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=0a7bc9ac5836678c0872f155522f357d5e39f8b2;p=mirror%2Fdsa-puppet.git Use a pre-up script to turn off accept_ra Turns out the /all/ sysctl is a no-op. --- diff --git a/modules/debian_org/files/ifupdown-pre-up-accept-ra b/modules/debian_org/files/ifupdown-pre-up-accept-ra new file mode 100644 index 000000000..109489176 --- /dev/null +++ b/modules/debian_org/files/ifupdown-pre-up-accept-ra @@ -0,0 +1,18 @@ +#!/bin/sh + +set -e + +[ "$IFACE" != "lo" ] || exit 0 +[ "$IFACE" != "--all" ] || exit 0 + +if [ -z "$IFACE" ]; then + echo "no interface specified" >&2 + exit 1 +fi + +if [ ! -d /proc/sys/net/ipv6/conf/$IFACE ]; then + echo "specified interface does not exist in /proc/sys/net/ipv6/conf/" >&2 + exit 1 +fi + +echo 0 > /procy/sys/net/ipv6/conf/$IFACE/accept_ra diff --git a/modules/debian_org/manifests/init.pp b/modules/debian_org/manifests/init.pp index be1fe7109..d45b12964 100644 --- a/modules/debian_org/manifests/init.pp +++ b/modules/debian_org/manifests/init.pp @@ -340,13 +340,15 @@ class debian_org { } # our ipv6 addresses and routes are statically configured. + file { '/etc/network/if-pre-up.d/no_accept_ra': + source => 'puppet://modules/debian_org/ifupdown-pre-up-accept-ra', + mode => '0555', + } base::sysctl { 'dsa-accept-ra-default': - key => 'net.ipv6.conf.default.accept_ra', - value => 0, + ensure => absent, } base::sysctl { 'dsa-accept-ra-all': - key => 'net.ipv6.conf.all.accept_ra', - value => 0, + ensure => absent, } # Disable kpartx udev rules